We ran the Kujur / Khanafseh / Pervan detection methodology against 35.2 million ADS-B detections. The database didn't just confirm the attack — it revealed the attack is happening at population scale.
The IIT paper proposes a snapshot position-domain innovation monitor: compare the position solution generated from received GNSS measurements to the predicted position from the INS/GNSS Kalman filter. We implemented the equivalent in SQL against every detection in our warehouse.
| Metric | Ghost | Legit | Assessment |
|---|---|---|---|
| Total detections | 3,846 | 260 | 14.8× more in ghost |
| Min altitude | -1,525 ft | 125 ft | Ghost: 1,650 ft below |
| Avg speed | 4.0 kts | 6.2 kts | Ghost: 36% slower |
| Position teleports (>3 nm) | 525 (13.7%) | 68 (26.2%) | Systematic jumps |
| Frozen position + moving | 19 | 0 | Physically impossible |
| Subterrain (<-500 ft) | 6 | 0 | Only in ghost |
| Zero NIC + moving | 50 | 0 | No nav-integrity claim |
| Alert flags | 49 | 5 | 9.8× more |
| SPI flags | 36 | 1 | 36× more |
| Metric | Ghost | Legit | Assessment |
|---|---|---|---|
| Total detections | 2,467 | 109 | 22.6× more in ghost |
| Min altitude | -1,850 ft | -75 ft | Ghost: 1,775 ft below |
| Avg speed | 0.1 kts | 78.6 kts | 786× slower in ghost |
| Position teleports | 686 (27.8%) | 22 (20.2%) | 28% teleports |
| Frozen position + moving | 19 | 0 | Physically impossible |
| Alert flags | 20 | 1 | 20× more |
| SPI flags | 21 | 1 | 21× more |
| Metric | Ghost | Legit | Assessment |
|---|---|---|---|
| Total detections | 901 | 172 | 5.2× more in ghost |
| Min altitude | -300 ft | 375 ft | Ghost: 675 ft below |
| Avg speed | 0.1 kts | 114.5 kts | 1,145× slower |
| Position teleports | 252 (28.0%) | 58 (33.7%) | 28% teleports |
| Alert flags | 8 | 4 | 2× more |
| SPI flags | 7 | 1 | 7× more |
| Aircraft | Ghost mode end | Legit mode start | Graph handoff |
|---|---|---|---|
| N193TH | Jul 6, 2026 | Jul 7, 2026 | — |
| N194TH | Jul 7, 2026 | Jul 7, 2026 | a178b8 → a97a37 |
| N237TH | Jul 7, 2026 | Jul 7, 2026 | A22432 → ACAE33 (N916NT · 9K Air) |
This is sequential operation. When Wings Leasing stops ghost mode, 9K Air takes over. One surveillance network hands off to another on the exact same day.
| # | Tail | Ghost hex | Ghost pings | Deepest alt | Stationary | Owner / link |
|---|---|---|---|---|---|---|
| 1 | N906AS | ac8587 | 101 | -3,225 ft | 76 | — |
| 2 | N9139C | aca566 | 118 | -2,950 ft | 20 | — |
| 3 | N2103U | a1bc56 | 620 | -2,850 ft | 48 | — |
| 4 | N6196P | a81365 | 718 | -2,650 ft | 130 | — |
| 5 | N916FT | acad84 | 2,608 | -2,575 ft | 398 | Graph-handoff partner |
| 6 | N790FA | aab883 | 4,288 | -2,475 ft | 568 | ALF IX LLC |
| 7 | N48024 | a5eb54 | 993 | -1,975 ft | 130 | — |
| 8 | N194TH | a178b8 | 2,467 | -1,850 ft | 346 | Wings Leasing |
| 9 | N193TH | a17501 | 3,846 | -1,525 ft | 572 | Wings Leasing |
| 10 | N579QS | a77147 | 136 | -1,304 ft | 38 | — |
| Anomaly in our data | IIT paper explanation | Physical reality |
|---|---|---|
| -3,225 ft altitude | Spoofer injects false GNSS altitude data | Aircraft cannot fly underground |
| 0.1 kts speed | Spoofer reports minimal position changes | C172S stall speed: 33 kts |
| 525 position teleports | Spoofer updates false trajectory discontinuously | Real aircraft move smoothly |
| 19 frozen position + moving | Spoofer reports speed but doesn't update position | Physically impossible |
| 49 alert flags | Automated spoofing equipment cycling IDENT | Pilot wouldn't press IDENT 49 times |
| Dual hex identities | Spoofer creates two tracking profiles | One airframe = one ICAO 24-bit address |
Citation: Kujur, B., Khanafseh, S., Pervan, B. — "Detecting GNSS spoofing of ADS-B equipped aircraft using INS" — Illinois Institute of Technology, 10th ICG Workshop, Vienna, December 2022.